Shadow data

Shadow data is every copy of your data living outside the systems you actually protect.

The spreadsheet exported for a board paper. The test database restored from production three years ago. The analytics extract in somebody's cloud drive. Each was created for a decent reason by somebody doing their job, and none of them appears on any diagram. Security controls are applied to the systems people know about, and breaches keep happening in the copies nobody remembered making.